What’s Vulnerable › Products
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress vulnerabilities
18 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.
Latest Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress vulnerabilities
- CVE-2026-39780 — WordPress Youzify plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- CVE-2026-81275 — WordPress Youzify plugin <= 1.3.7 - Arbitrary File Download vulnerability (CVSS 6.5)
- CVE-2026-73397 — WordPress Youzify plugin <= 1.3.7 - Deserialization of untrusted data vulnerability (CVSS 9.8)
- CVE-2026-1559 — Youzify <= 1.3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkin_place_id' Parameter (CVSS 6.4)
- CVE-2025-69014 — WordPress Youzify plugin <= 1.3.7 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.9)
- CVE-2024-13370 — Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.3 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update (save_addon_key_license) (CVSS 6.5)
- CVE-2024-13368 — Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.4 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update (CVSS 4.3)
- CVE-2024-12113 — Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress By KaineLabs <= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Review Deletion (CVSS 4.3)
- CVE-2024-39635 — WordPress Youzify plugin <= 1.2.6 - Broken Access Control vulnerability (CVSS 8.8)
- CVE-2024-9067 — Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.0 - Missing Authorization to Arbitrary (Subscriber+) Attachment Deletion (CVSS 4.3)
- CVE-2024-8987 — Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via youzify_media Shortcode (CVSS 5.4)
- CVE-2024-37494 — WordPress Youzify plugin <= 1.2.5 - SQL Injection vulnerability (CVSS 8.8)
- CVE-2024-4742 — Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.2.5 - Authenticated (Contributor+) SQL Injection (CVSS 6.5)
- CVE-2024-2864 — WordPress Youzify - Buddypress Moderation plugin <= 1.2.5 - Unauthenticated Cross Site Scripting (XSS) vulnerability (CVSS 6.1)
- CVE-2023-47191 — WordPress Youzify Plugin <= 1.2.2 is vulnerable to Insecure Direct Object References (IDOR) (CVSS 6.5)
- CVE-2023-0059 — Youzify < 1.2.2 - Contributor+ Stored XSS (CVSS 5.4)
- CVE-2022-1950 — Youzify < 1.2.0 - Unauthenticated SQLi (CVSS 9.8)
- CVE-2021-24443 — Youzify < 1.0.7 - Stored Cross-Site Scripting via Biography (CVSS 5.4)